ZenTao Analytics

禅道任务数据分析技能。访问禅道数据库/API，分析员工任务数据（数量、工时、难度），计算工作效率和工作饱和度。使用场景：团队绩效评估、工作量分析、资源分配优化、项目进度监控。

This skill appears to be an analytics helper for ZenTao and is not obviously malicious, but it's incomplete and inconsistent. Before installing or running it: 1) Do not run it with production/root DB credentials — create a limited read‑only account or use a test instance. 2) Expect that the scripts are partially stubbed: fetchTaskData is a demo and there are missing helper scripts (test-connection.js) and no package.json; ask the author for a full implementation and dependency list. 3) Verify where credentials are stored (use a secure .env and avoid committing secrets). 4) Review the code locally to ensure no hidden network endpoints or exfiltration paths were added, and test on a sandboxed ZenTao instance first. 5) If you need the registry to show required env vars, request that the publisher update metadata to declare ZENTAO_URL, ZENTAO_API_KEY and/or DB credentials explicitly and provide guidance on least-privilege credentials.

Type: OpenClaw Skill Name: zentao-analytics Version: 1.0.0 The skill is designed to perform ZenTao analytics, which inherently requires handling highly sensitive credentials (API keys, database usernames/passwords) and making external network/database connections. The `scripts/analyze-tasks.js` file is configured to read these credentials from environment variables, and although it currently uses mock data, a `TODO` comment indicates that real API/database calls are planned. This capability, while necessary for the skill's stated purpose, introduces significant security risk due to the handling of sensitive data and external connectivity, classifying it as suspicious rather than benign.